DiSE: Distributed Symmetric-key Encryption∗ Shashank Agrawal Payman Mohassel Pratyay Mukherjee Peter Rindal shaagraw,pmohasse,pratmukh,[email protected] Visa Research ABSTRACT asymmetric-key setting, namely public-key encryption and signa- Threshold cryptography provides a mechanism for protecting se- ture schemes [15, 22, 24, 25, 29, 33, 34, 36, 48, 49, 69] where the cret keys by sharing them among multiple parties, who then jointly signing/decryption key and algorithms are distributed among mul- perform cryptographic operations. An attacker who corrupts upto tiple parties. This is despite the fact that a large fraction of applica- a threshold number of parties cannot recover the secrets or vio- tions that can benefit from stronger secret-key protection primarily late security. Prior works in this space have mostly focused on use symmetric-key cryptographic primitives wherein secret keys definitions and constructions for public-key cryptography and dig- persist for a long time. We review three such examples below: ital signatures, and thus do not capture the security concerns and Secret Management Systems. An increasing number of tools and efficiency challenges of symmetric-key based applications which popular open source software such as Keywhiz, Knox, and Hashicorp commonly use long-term (centralized) master keys to protect data Vault (e.g. see [4]) are designed to automate the management and at rest, authenticate clients on enterprise networks, and secure data protection of secrets such as sensitive data and credentials in cloud- and payments on IoT devices. based settings by encrypting data at rest and managing keys and We put forth the first formal treatment for distributed symmetric- authentication. These tools provide a wide range of features such as key encryption, proposing new notions of correctness, privacy and interoperability between clouds and audit/compliance support. By authenticity in presence of malicious attackers. We provide strong far, the most commonly adopted primitive for encrypting secrets in and intuitive game-based definitions that are easy to understand the storage backend is authenticated encryption with a master data and yield efficient constructions. encryption key that encrypts a large number of records. Some of We propose a generic construction of threshold authenticated en- these systems use secret sharing to provide limited key protection cryption based on any distributed pseudorandom function (DPRF). in an initialization stage but once keys are reconstructed in memory When instantiated with the two different DPRF constructions pro- they remain unencrypted until the system is rebooted. Consider posed by Naor, Pinkas and Reingold (Eurocrypt 1999) and our en- the following statement from Hashicorp Vault’s architecture docu- hanced versions, we obtain several efficient constructions meeting mentation [12]: different security definitions. We implement these variants and “Once started, the Vault is in a sealed state ::: When the Vault is initialized provide extensive performance comparisons. Our most efficient it generates an encryption key which is used to protect all the data. That key is instantiation uses only symmetric-key primitives and achieves a protected by a master key. By default, Vault uses a technique known as Shamir’s secret throughput of upto 1 million encryptions/decryptions per seconds, sharing algorithm to split the master key into 5 shares, any 3 of which are required to or alternatively a sub-millisecond latency with upto 18 participating reconstruct the master key ::: Once Vault retrieves the encryption key, it is able to parties. decrypt the data in the storage backend, and enters the unsealed state." 1 INTRODUCTION Enterprise Network Authentication. Network authentication pro- A central advantage of using cryptographic primitives such as tocols such as Kerberos [6] are widely used to provide a single-sign- symmetric-key encryption is that the safety of a large amount of on experience to users by enabling them to authenticate periodically sensitive data can be reduced to the safety of a very small key. To (e.g. once a day) to a ticket-granting service using their credentials, get any real benefit from this approach, however, the key mustbe to obtain a ticket-granting ticket (TGT) that they use to get access protected securely. One could encrypt the key with another key, to various services such as mail, printers and internal web. The protect it using secure hardware (e.g. HSM, SGX or SE), or split recommended approach for generating the TGT is authenticated en- it across multiple parties. Clearly, the first approach only shifts cryption (e.g. see [5]) using a master secret key in order to provide the problem to protecting another key. On the other hand secure both confidentiality and integrity for the information contained in hardware, co-processors and the like provide reasonable security the ticket. This renders the master secret key an important attack but are not always available, are expensive or not scalable, lack target, as it remains unprotected in memory over a long period. programmability and are prone to side-channel attacks. Splitting the key among multiple parties, i.e. threshold cryp- Multi-device IoT Authentication. The proliferation of a wide range tography, is an effective general-purpose solution, that has re- of Internet of Things (IoT) has provided users with new and conve- cently emerged in practice as an alternative software-only solu- nient ways to interact with the world around them. Such devices tion [2, 10, 11]. Surprisingly, prior to our work, there was no for- are increasingly used to store secrets that are used to authenti- mal treatment of distributed symmetric-key encryption. Prior for- cate users or enable secure payments. Many IoT devices are not mal treatments of threshold cryptography typically focus on the equipped with proper environments to store secret keys, and even when they are, provide developers with little programmability for ∗ An extended abstract [16] of this work appeared in ACM Conference on Computer their applications. It is therefore desirable to leverage the fact that and Communications Security, 2018. The full version [17] can be found at https: //eprint.iacr.org/2018/727.pdf many users own multiple devices (smart phone, smart watch, smart TV, etc.) to distribute the key material among them (instead of proposed definitions. See the overview in Section 2 for amore keeping it entirely on any single device) to enable multi-device detailed discussion. cryptographic functionalities without making strong assumptions Performance Challenges. In addition to not meeting our security about a device’s security features. Given the limited computation notions, existing threshold public-key constructions are too expen- and communication power of many such IoT devices, such dis- sive for symmetric-key use cases, as they are dominated by more tributed primitives should require minimal interaction and limited expensive public-key operations and/or require extensive interac- cryptographic capabilities (e.g. only block-ciphers). tion and communication between the parties. Applications that use symmetric-key cryptography often have stringent latency or throughput requirements. Ideally, one would like the distributed 1.1 Technical Challenges encryption/decryption protocols to not be significantly more ex- Modeling security. As discussed earlier, existing threshold cryp- pensive than their non-distributed counterparts. In particular, the tographic definitions and constructions are primarily focused on protocols should have low computation and bandwidth cost, and public-key primitives such as digital signatures and public-key en- require minimal interaction. cryption. In fact, to the best of our knowledge, there is no standard General-purpose multi-party computation protocols can also be symmetric-key security notions in the distributed setting. used to solve the same problems by computing standard symmetric- Note that threshold authenticated encryption (TAE) is the ap- key encryption schemes inside an MPC (e.g. see [2, 65]). While this propriate and natural notion here as it would simultaneously solve approach has the benefit of preserving the original non-interactive the confidentiality and the authenticity problem, such that a cipher- algorithm, the resulting protocols would be prohibitively interac- text generated by the TAE scheme could be both an authentica- tive, bandwidth-intensive, and would become increasingly expen- tion token and an encrypted message. Unfortunately, while defini- sive for larger number of parties. In this paper, we aim for two-round tions for threshold public-key encryption are well-understood (e.g. protocols where one server sends a message to other servers and see [22, 25, 29, 35, 68]), as we elaborate next, they fail to capture receives a response, while other servers need not exchange any important subtleties that only arise in the symmetric-key setting messages. This minimal interaction model minimizes coordination when considering standard AE notions of message privacy and between the servers and is ideal for low-latency applications. ciphertext integrity. We review the MPC-based solutions and other related work on What truly separates TAE from threshold public-key encryption protecting cryptographic secrets through splitting them among is that in TAE a corrupted party should not be able to encrypt or multiple parties (i.e. secret sharing, threshold PKE and threshold decrypt messages on her own or even